<![CDATA[Security authentication is a primary challenge in IoT systems relying on resource-constrained devices. JSON Web Token (JWT) is widely adopted as a stateless authentication mechanism, yet the choice of signing algorithm—RS256, ES256, HS256, or Delegated Auth—carries different security implications. This study analyzes four strategies using STRIDE on a Go/Echo-based API Gateway-IoT architecture with ESP8266 NodeMCU V3 devices, per system component. RS256 and ES256 have the smallest blast radius since private keys are per-device, while HS256 is vulnerable to mass exposure if the gateway database is compromised. Delegated Auth offers fastest revocation via gateway blacklist but inherits HS256's shared-secret weaknesses. Empirical data from 1,260 runs show ES256 requires 248.98 ms to sign a JWT (488× slower than HS256 at 0.51 ms), while RS256 is inoperable due to watchdog timer crashes (>8 seconds). These findings guide IoT system designers in selecting JWT strategies suited to their risk profile and device capabilities.]]>
Copyrights © 2026
